Cyber threats don’t stop at traditional security infrastructure. Attackers increasingly target backup environments to disrupt recovery, yet activity within these environments can remain disconnected from the tools and workflows security teams use to monitor and investigate threats.
A new integration between Veeam and Arctic Wolf helps close that gap by bringing backup and security events into Aurora® Managed Detection and Response. By extending visibility into critical backup infrastructure, Arctic Wolf’s Aurora® Agentic SOC gains additional context to identify suspicious activity, investigate threats, and correlate Veeam activity with security data from across the customer’s environment.
Extend security visibility to the backup environment
With the new integration, Veeam Data Platform provides Arctic Wolf with security-relevant activity from across the backup environment. This gives security teams visibility into an area that may otherwise sit outside their day-to-day monitoring.
That activity includes:
- Backup job activity and restore operations
- Malware detections
- Administrative actions, such as privilege and configuration changes
- Events related to repositories, storage health, and backup infrastructure
When combined, these events can help surface activity that warrants a closer look. An unauthorized restore attempt, unexpected privilege change, failed operation, or malware detection may each provide important context during a cyber incident.
Turn backup activities into actionable security context
Visibility is only useful if teams can make sense of it. Arctic Wolf applies its security monitoring and detection capabilities to Veeam data, helping distinguish meaningful security events from routine backup activity. Veeam event classifications and outcomes provide additional context, with events ranging from successful operations to failures and critical malware detections.
When suspicious activity is identified, the Aurora® Agentic SOC can use Veeam event data alongside security data from across the customer’s environment to investigate and correlate related activity. A malware finding within Veeam, for example, can become another piece of the broader incident picture rather than an isolated backup alert.
That added context can help teams connect related indicators, understand what is happening across the environment, and provide a more complete view of a potential threat.
Connect backup and security operations
Backup and security teams play different but increasingly connected roles during a cyber incident. Security teams are focused on detecting and investigating malicious activity, while backup teams need to understand whether critical recovery infrastructure or backup data may have been affected. When these teams are working across separate tools, important context can be harder to share when time matters most.
Bringing Veeam activity into Aurora® Managed Detection and Response helps unite those workflows. Security analysts gain visibility into activity occurring within the backup environment, while IT teams benefit from having that context considered as part of the broader security picture.
Looking ahead
This integration is an important first step in the Veeam and Arctic Wolf partnership. As the partnership evolves, we’ll continue to explore new ways to bring backup intelligence into managed security operations, helping organizations strengthen cyber resilience and better connect IT and Security teams.
To get started, explore the Arctic Wolf integration documentation for configuration details. To learn more about the Veeam and Arctic Wolf partnership, contact alliances@arcticwolf.com.
The post Veeam and Arctic Wolf bring backup intelligence into agentic security operations appeared first on Veeam Software Official Blog.
from Veeam Software Official Blog https://ift.tt/Zx0tyuE
Share this content: